JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 157.66.56.108

157.66.56.108 was found in our database!

This IP was reported 38 times. Confidence of Abuse is 44%: ?

44%

ISP	Argon Data Communication
Usage Type	Data Center/Web Hosting/Transit
ASN	AS58477
Domain Name	argonhost.com
Country	🇮🇩 Indonesia
City	Jakarta, Jakarta

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 157.66.56.108

Whois 157.66.56.108

IP Abuse Reports for 157.66.56.108:

This IP address has been reported a total of 38 times from 23 distinct sources. 157.66.56.108 was first reported on May 1st 2025, and the most recent report was 5 hours ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇺🇸 nyt	2026-06-25 16:08:57 (5 hours ago)	Scanner UA, Unusual file request by a scanner user agent	Bad Web Bot Web App Attack
🇺🇸 Alvino	2026-06-25 10:59:33 (10 hours ago)	Blocked due to using a VPN or data center IP with abuse: 33	Web Spam VPN IP
🇯🇵 S.O.B.A. Dev.	2026-06-25 00:43:35 (20 hours ago)	Web vulnerability scanning	Brute-Force Web Spam Web App Attack
🇺🇸 TPI-Abuse	2026-06-24 12:31:53 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 157.66.56.108 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 157.66.56.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 24 08:31:48.292388 2026] [security2:error] [pid 1155:tid 1274] [client 157.66.56.108:49210] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|montanatribes.org\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "montanatribes.org"] [uri "/defunct.dat"] [unique_id "ajvONFa-ZTxis9E9C_vBvAAAARg"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-24 03:59:38 (1 day ago)	(mod_security) mod_security (id:210730) triggered by 157.66.56.108 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 157.66.56.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 23:59:31.045449 2026] [security2:error] [pid 10543:tid 10543] [client 157.66.56.108:61208] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.fashionmenswear.com\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.fashionmenswear.com"] [uri "/defunct.dat"] [unique_id "ajtWI0wjLSihHhR1TfG-QQAAAA0"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 TPI-Abuse	2026-06-23 08:14:32 (2 days ago)	(mod_security) mod_security (id:210730) triggered by 157.66.56.108 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 157.66.56.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 23 04:14:25.544274 2026] [security2:error] [pid 7211:tid 7211] [client 157.66.56.108:50408] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|babylontravelone.com\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "babylontravelone.com"] [uri "/defunct.dat"] [unique_id "ajpAYVLrQG2N4UV1qmeh_QAAABA"] show less	Brute-Force Bad Web Bot Web App Attack
🇨🇭 4server	2026-06-17 23:19:58 (1 week ago)	[ThuJun1801:19:54.4828552026][security2:error][pid3253918:tid3254278][client157.66.56.108:0]ModSecur ... show more [ThuJun1801:19:54.4828552026][security2:error][pid3253918:tid3254278][client157.66.56.108:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/.dat/.db/.dbf/.dll/.dos/.htr/.htw/.ida/.idc/.idq/.inc/.ini/.key/.licx/.lnk/.log/.mdb/.old/.pass/.pdb/.pol/.printer/.pwd/.rdb/.resources/.resx/.sql/.swp/.sys/.vb/.vbs/.vbproj/.vsdisco/.webinfo/.xsx/\"atTX:extension.[file\"/etc/apache2/conf.d/modsec_rules/00_asl_zz_strict.conf\"][line\"91\"][id\"390716\"][rev\"2\"][msg\"Atomicorp.comWAFRules:URLfileextensionisrestrictedbypolicy\"][data\".dat\"][severity\"ERROR\"][hostname\"marcionetti.es\"][uri\"/defunct.dat\"][unique_id\"ajMrmkrKbEKwkUd8vtRl0AAAARA\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-14 19:34:21 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 157.66.56.108 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 157.66.56.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 15:34:12.997531 2026] [security2:error] [pid 28853:tid 28853] [client 157.66.56.108:61707] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|www.dismain.com\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.dismain.com"] [uri "/tienda/defunct.dat"] [unique_id "ai8CNI6AyW08GWNQYpj5rwAAAAs"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 lentawaf	2026-06-14 12:19:00 (1 week ago)	Searches for files associated with the Gsocket backdoor, attack, or infected device.	Exploited Host Web App Attack Hacking
🇨🇭 4server	2026-06-14 04:54:51 (1 week ago)	[SunJun1406:54:45.2482502026][security2:error][pid487922:tid488183][client157.66.56.108:0]ModSecurit ... show more [SunJun1406:54:45.2482502026][security2:error][pid487922:tid488183][client157.66.56.108:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/.dat/.db/.dbf/.dll/.dos/.htr/.htw/.ida/.idc/.idq/.inc/.ini/.key/.licx/.lnk/.log/.mdb/.old/.pass/.pdb/.pol/.printer/.pwd/.rdb/.resources/.resx/.sql/.swp/.sys/.vb/.vbs/.vbproj/.vsdisco/.webinfo/.xsx/\"atTX:extension.[file\"/etc/apache2/conf.d/modsec_rules/00_asl_zz_strict.conf\"][line\"91\"][id\"390716\"][rev\"2\"][msg\"Atomicorp.comWAFRules:URLfileextensionisrestrictedbypolicy\"][data\".dat\"][severity\"ERROR\"][hostname\"marcionetti.es\"][uri\"/defunct.dat\"][unique_id\"ai40FTasLKYeI6uWu5JYwwAAAIw\"] show less	Hacking Web App Attack
🇺🇸 TPI-Abuse	2026-06-14 03:40:05 (1 week ago)	(mod_security) mod_security (id:210730) triggered by 157.66.56.108 (-): 1 in the last 300 secs; Port ... show more (mod_security) mod_security (id:210730) triggered by 157.66.56.108 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 23:39:58.803875 2026] [security2:error] [pid 16454:tid 16454] [client 157.66.56.108:57818] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|auracb.es\|F\|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "auracb.es"] [uri "/defunct.dat"] [unique_id "ai4ijqvO1vFHkssATEY8kQAAAAQ"] show less	Brute-Force Bad Web Bot Web App Attack
🇮🇩 Burayot	2026-06-13 01:49:47 (1 week ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 157.66.56.108 (ID/Indonesia/-): 1 in ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 157.66.56.108 (ID/Indonesia/-): 1 in the last 3600 secs show less	Web App Attack
🇮🇩 Burayot	2026-06-05 08:56:19 (2 weeks ago)	LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 157.66.56.108 (ID/Indonesia/-): 1 in ... show more LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 157.66.56.108 (ID/Indonesia/-): 1 in the last 3600 secs show less	Web App Attack
🇺🇸 Hmorrin	2026-04-04 06:16:19 (2 months ago)		Port Scan
Anonymous	2026-03-30 00:10:37 (2 months ago)	eval-stdin.php	Hacking Brute-Force Web App Attack

Showing 1 to 15 of 38 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇧🇷 2804:1b3:9801:55cf:686d:1165:15e0:e9d4

🇰🇷 210.104.222.189

🇨🇳 171.104.143.176

🇩🇪 167.94.146.71

🇻🇳 103.167.89.222

🇧🇩 103.119.177.43

🇺🇸 91.230.168.121

🇱🇹 45.227.254.170

🇮🇩 163.7.11.155

🇳🇬 103.97.91.27

🇨🇳 223.101.72.136

🇨🇳 220.181.108.166

🇺🇸 213.201.243.200

🇪🇨 186.68.83.104

🇧🇷 177.75.137.163

🇺🇸 136.144.33.229

🇨🇳 116.179.32.165

🇳🇱 91.92.40.7

🇫🇷 85.217.140.39

🇨🇳 223.108.185.218